package com.pb.service.boot.config;

import org.apache.commons.lang.StringEscapeUtils;
import org.springframework.web.util.HtmlUtils;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.util.Map;

/**
 * 配置
 *
 * @Author:liaohaoyuan
 * @Date: 2022/3/29
 */
public class XSSRequestWrapper extends HttpServletRequestWrapper {

    public XSSRequestWrapper(HttpServletRequest request){
        super(request);
    }

    @Override
    public String getHeader(String name) {
        return StringEscapeUtils.escapeHtml(super.getHeader(name));
    }

    @Override
    public String getQueryString() {
        return StringEscapeUtils.escapeHtml(super.getQueryString());
    }

    @Override
    public String [] getParameterValues(String name){
        String [] values = super.getParameterValues(name);
        if(values != null){
            int length = values.length;
            String [] escapseValues = new String[length];
            for (int i = 0; i < length; i++) {
                escapseValues[i] = htmlEncode(values[i]);
            }
            return escapseValues;
        }
        return super.getParameterValues(name);
    }

    @SuppressWarnings("rawtypes")
    @Override
    public Map<String, String[]> getParameterMap() {
        Map<String, String[]> requestMap = super.getParameterMap();
        for (Object o : requestMap.entrySet()) {
            Map.Entry me = (Map.Entry) o;
            String[] values = (String[]) me.getValue();
            for (int i = 0; i < values.length; i++) {
                values[i] = htmlEncode(values[i]);
            }
        }
        return requestMap;
    }

    @Override
    public String getParameter(String paramString){
        String str = super.getParameter(paramString);
        if(null == str){
            return null;
        }
        return htmlEncode(str);
    }

    private static String htmlEncode(String source){
        if(null == source || "".equals(source)){
            return source;
        }
        try{
            source = URLDecoder.decode(source,"UTF-8");
        }catch (UnsupportedEncodingException e) {
//            e.printStackTrace();
        }
        source = HtmlUtils.htmlEscape(source);
        source = source.replaceAll("&lt;","<").replaceAll("&gt;",">");
        source = source.replaceAll("\\(","(").replaceAll("\\(",")");
        source = source.replaceAll("&quot;","\"");
        source = source.replaceAll("'","\'");
        source = source.replaceAll("eval\\((.*)","");
        source = source.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']","\"\"");
        source = source.replaceAll("script","\"script\"");
        source = source.replaceAll("link","\"link\"");
//        source = source.replaceAll("frame","");
        //sql注入`
//        source = source.replaceAll("select", "seleсt").replaceAll("truncate", "trunсate").replaceAll("exec", "exeс").replaceAll("join", "jоin").replaceAll("union", "uniоn").replaceAll("drop", "drоp").replaceAll("insert", "insеrt").replaceAll("update", "updatе").replaceAll("delete", "dеlеtе");
        String html = "";
        StringBuffer buffer = new StringBuffer(source.length() + 16);
        for (int i = 0; i < source.length(); i++) {
            char c =source.charAt(i);

            switch (c){
                case '<':
                    buffer.append("＜");
                    break;
                case '>':
                    buffer.append("＞");
                    break;
                case '\'':
                    buffer.append("'");
                    break;
//                case '\"':
//                    buffer.append("″");
//                    break;
                case '&':
                    buffer.append("＆");
                    break;
                default:
                    buffer.append(c);
            }
        }
        html = buffer.toString();
        return html;
    }
}
